- 26 October 2026
Boardroom Bellwether 2026 finds charities far behind companies on cyber preparedness, while charity boards with the weakest AI capability are less likely to treat it as a governance priority
More than four in ten (42%) charity and not-for-profit governance professionals say their organisation’s preparedness to respond to a cyber attack at board or governance level is limited or non-existent, according to Boardroom Bellwether 2026, published today by The Chartered Governance Institute UK & Ireland. In listed and private companies, the figure is 3%.
The survey graded preparedness from very thorough, meaning scenario-based plans with explicit crisis roles, escalation and pre-set decision-making, down to limited. Two-thirds (65%) of company respondents describe their preparedness as very thorough, compared with 26% of charities. The report notes that charity governance teams are rarely large and often have limited in-house IT support.
The gap comes as boards in every sector pay closer attention to cyber risk. Three-quarters (75%) of all respondents say their board’s focus on cyber security has increased over the past year.
Charity boards are also the least equipped to oversee artificial intelligence. More than three-quarters (76%) of charity respondents describe their board’s capability in this area as limited or absent, compared with 40% in companies. A third (33%) say their board has no meaningful capability at all. One charity governance leader identified the risk as “the trustees not keeping up with the developments, risks and their responsibilities around AI”.
Despite this, charities are less likely to treat AI as a governance priority. Asked which three areas would most benefit from stronger governance capability, 45% of charity respondents named AI, compared with 82% of listed company governance professionals. Charity respondents were more than twice as likely as those in companies to name financial resilience, reflecting the financial strain on the sector.
Board skills are a wider concern. Charity respondents are more than twice as likely as listed company respondents to cite a lack of board expertise or experience as a material challenge to good governance. More than three quarters (77%) say the governance issues facing their organisation have increased over the past year.
Linda Ford, Chief Executive of The Chartered Governance Institute UK & Ireland, said:
“Charity boards are largely made up of volunteer trustees, supported by governance teams that are often very small. These findings show many of them facing cyber and AI risks without the preparation or expertise those risks demand, while financial pressures compete for their time and resources.
The report points to two distinct challenges. Many charity boards are still building the knowledge and confidence needed to oversee AI effectively, while cyber security is often an implementation challenge.
The Institute provides guidance, training and qualifications to help boards and governance professionals respond to both, but financial pressures can make it difficult for charities to prioritise investment in resilience.
As cyber threats continue to grow in scale and sophistication, policymakers, funders and regulators should consider whether charities have sufficient practical support to turn guidance into effective protections.”